CVE-2026-33032 2

Vulnerability (CVE)

Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

CVE-2026-33032, a CVSS 9.8 authentication bypass in the open-source nginx-ui management tool, is under active exploitation; its /mcp_message endpoint applies only IP whitelisting, and the default empty whitelist is treated as 'allow all.' Pluto Security...

Zero-Days & Exploits

⚡ Weekly Recap: Vercel Hack, Push Fraud, QEMU Abused, New Android RATs Emerge & More

Cyber Risks The Hacker News

Vercel disclosed a breach in which attackers compromised the third-party AI tool Context.ai, used that access to take over an employee's Vercel Google Workspace account, and reached some Vercel environments and environment variables not marked as...

Data Breaches